Russian hackers hit iPhones and Androids via websites
A watering hole campaign linked to APT29 used compromised and fake sites to attack iOS and Android users without a click, according to BleepingComputer's report on Sekoia's findings.
The facts
- Sekoia researchers attribute the campaign with moderate-to-high confidence to APT29, also known as Midnight Blizzard, a Russian threat group, according to BleepingComputer.
- Compromised sites included a Ukrainian gas producer, a U.S. chemical industry trade association and a Bulgarian military-related site. Lookalike domains impersonated the America250 site and Raffles London at The OWO hotel.
- The attackers also compromised Ukrainian analytics service Plerdy and altered its SEO tracker, which thousands of sites loaded between August 27 and September 3.
- Sekoia says none of the payloads set up persistence, so a reboot stops the activity. Apple and Google have patched all the flaws used.
Case notes · Danny's take
Why it matters
No click, no download, no warning. Just visiting the wrong page. That is what a watering hole attack does: the attacker poisons a place you already trust and waits for you to arrive. Note the target list too. A trade body, a gas producer, a hotel brand. State-linked groups go where the people they want already go.
For builders
If your site loads third-party scripts such as analytics or SEO trackers, one compromised vendor reaches all your visitors. Audit what you load, pin and review script sources, and keep a way to cut a vendor off fast. Tell users to install the latest iOS and Android updates, since the exploited flaws are already patched.
Not financial advice. Do your own investigation.
This story was summarised with AI from BleepingComputer's reporting and checked against our editorial policy. Danny's take reflects his views. Disclaimer.
Danny Walter
Founder of Moon Republic, Volt Terminal and Moon Republic Academy. Author of The Market Is a Crime Scene and After the Applause.